clean up URLs; add /corrections/self; ensure there is a secret for hashing REMOTE ADDR